D-Link 800 - DFL 800 - Security Appliance, User Manual, Page: 349 / 469

1. Go to Interfaces > IPsec > Add > IPsec Tunnel
2. Now enter:
• Name: RoamingIPsecTunnel
• Local Network: 10.0.1.0/24 (This is the local network that the roaming users will connect to)
• Remote Network: all-nets
• Remote Endpoint: (None)
• Encapsulation Mode: Tunnel
3. For Algorithms enter:
• IKE Algorithms: Medium or High
• IPsec Algorithms: Medium or High
4. For Authentication enter:
• Choose X.509 Certificate as authentication method
• Root Certificate(s): Select all your client certificates and add them to the Selected list
• Gateway Certificate: Choose your newly created firewall certificate
• Identification List: Select your ID List that you want to associate with your VPN Tunnel. In our case that
will be sales
5. Under the Routing tab:
• Enable the option: Dynamically add route to the remote network when a tunnel is established.
6. Click OK
E. Finally configure the IP rule set to allow traffic inside the tunnel.
9.4.3.3. Tunnels Based on CA Server Certificates
Setting up client tunnels using a CA issued certificate is largely the same as using Self-signed
certificates with the exception of a couple of steps. Most importantly, it is the responsibility of the
administrator to acquire the appropriate certificate from an issuing authority. With some systems,
such as Windows 2000 Server, there is built-in access to a CA server (in Windows 2000 Server this
is found in Certificate Services). For more information on CA server issued certificates see
Section 3.7, “Certificates”.
It is the responsibility of the administrator to acquire the appropriate certificate from an issuing
authority for client tunnels. With some systems, such as Windows 2000 Server, there is built-in
access to a CA server (in Windows 2000 Server this is found in Certificate Services). For more
information on CA server issued certificates see Section 3.7, “Certificates”.
Example 9.6. Setting up a CA Server issued Certificate based VPN tunnel for roaming
clients
This example describes how to configure an IPsec tunnel at the head office D-Link Firewall for roaming clients
that connect to the office to gain remote access. The head office network uses the 10.0.1.0/24 network span with
external firewall IP wan_ip.
Web Interface
A. Upload all the client certificates:
1. Go to Objects > Authentication Objects > Add > Certificate
2. Enter a suitable name for the Certificate object
9.4.3. Roaming Clients Chapter 9. VPN
349